Certificate connection issue between Azure Logic App Standard to On-Prem IBM MQ Server using mTLS

[pravingh]

I'm facing the connectivity between Azure Logic App Standard In-Built connector (Deployed on App Service WS*).
mTLS handhake is failing with error code:

{
reasonCode: 2009
reasonDescryption: “The service provider operation 'pollAvilable' has terminated because of bad gateway.”
}

Logs captured are MQ Server say:
AMQ9999E: Channel 'xxxx.xxxx.xx1' to host '10.10.10.10' ended abnormally.

Network error logs capture shows connection is failing with thumbnail issue: (Thumbprint value is replaced with xxxx)
<<M:Server Cert Thumbprint: 102Cxxxxxxxxxxxxxxxxxxxxxxxxx was not found.

Certificate used with Thumbprint value printed in error log is not used by MQ Server or client Logic App connector.

Have you faced similar issue? Any pointer to resolve or troubleshoot this issue?

[clowa]

I haven't faced the same error, but I know the error message <<M:Server Cert Thumbprint: 102Cxxxxxxxxxxxxxxxxxxxxxxxxx was not found occures when the Logic App doesn't trust the MQ Server certificate. I solved this by importing the public certificate of the MQ server into the Trusted Store of the Logic App. You can do this by following these steps:

1. Retrieve the public certificate of the MQ server in .cer format.
2. Go to the Azure Portal and open the Logic App. Go to Settings -> Certificates -> Public key certificates (.cer) -> Add certificate
3. Upload the .cer file and save the changes and note the Thumbprint of the certificate.
4. Switch to Settings -> Environment variables and add a new variable with the name WEBSITE_LOAD_ROOT_CERTIFICATES and add the thumbprint of the certificate you uploaded in the previous step. You can add multiple thumbprints separated by comma.

See this microsoft documentation for more.

If your Logic App runs on App Service Environment you can even add a private/internal CA that was used to sign the MQ server certificate to the machines trusted store.